From 81b49e8f892a977f3821f3416ea51aa641d63ac4 Mon Sep 17 00:00:00 2001 From: Ray Strode Date: Sat, 18 Oct 2014 22:12:49 -0400 Subject: libcacard: don't free sign buffer while sign op is pending commit 57f97834efe0c208ffadc9d2959f3d3d55580e52 cleaned up the cac_applet_pki_process_apdu function to have a single exit point. Unfortunately, that commit introduced a bug where the sign buffer can get free'd and nullified while it's still being used. This commit corrects the bug by introducing a boolean to track whether or not the sign buffer should be freed in the function exit path. Signed-off-by: Ray Strode Reviewed-by: Alon Levy Signed-off-by: Gerd Hoffmann --- libcacard/cac.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libcacard/cac.c b/libcacard/cac.c index ae8c3784b9..f38fdceddd 100644 --- a/libcacard/cac.c +++ b/libcacard/cac.c @@ -115,6 +115,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, VCardAppletPrivate *applet_private; int size, next; unsigned char *sign_buffer; + bool retain_sign_buffer = FALSE; vcard_7816_status_t status; VCardStatus ret = VCARD_FAIL; @@ -178,6 +179,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, pki_applet->sign_buffer = sign_buffer; pki_applet->sign_buffer_len = size; *response = vcard_make_response(VCARD7816_STATUS_SUCCESS); + retain_sign_buffer = TRUE; break; case 0x00: /* we now have the whole buffer, do the operation, result will be @@ -200,9 +202,11 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); break; } - g_free(sign_buffer); - pki_applet->sign_buffer = NULL; - pki_applet->sign_buffer_len = 0; + if (!retain_sign_buffer) { + g_free(sign_buffer); + pki_applet->sign_buffer = NULL; + pki_applet->sign_buffer_len = 0; + } ret = VCARD_DONE; break; case CAC_READ_BUFFER: -- cgit v1.2.3